Treat prompts, retrieved content, and external inputs as untrusted by default. Separate instruction sources architecturally, filter adversarial text before it reaches the model, and restrict tool access so a successful injection cannot immediately trigger code execution, data exposure, or downstream action without additional controls.
How to prevent prompt injection from turning into code execution or data loss
Prompt injection becomes dangerous when the model is allowed to treat untrusted text as instructions, or when its outputs can directly drive tools, code paths, or privileged data access. The practical fix is to design for containment: isolate instruction sources, reduce what the model can do by default, and force a second decision layer before any action that could modify systems or expose sensitive information.
The biggest mistake is assuming the model can reliably distinguish harmless content from malicious instructions on its own. It cannot, so organisations need boundary controls around retrieval, tool invocation, and data egress. That means the prompt pipeline should behave more like a security boundary than a convenience feature, especially once the system can browse, search, write, execute, or retrieve customer data.
A useful way to think about the problem is blast radius. If an injection lands in a read-only assistant with no tools, the damage is often limited to bad output. If the same injection reaches an agent with shell access, SaaS permissions, or write access to records, the same attack can become code execution, fraud, or a data breach. The controls should therefore be proportionate to the action the model can trigger, not to the harmlessness of the interface text alone.
Where the control boundary should sit
Separate system instructions, user prompts, retrieved content, and external inputs so they are never merged into a single trust zone. Retrieved pages, tickets, emails, documents, and web snippets should be treated as content, not authority. That separation should be enforced in architecture, not just in prompt wording, because prompt wording is the first thing attackers try to manipulate.
Tool access should also be conditional rather than automatic. If a prompt asks the model to fetch, send, delete, or execute, the request should pass through explicit policy checks, allowlists, and scoped permissions before the tool receives it. In practice, this is the difference between an assistant that can answer questions and an agent that can change state in the environment.
For teams building agentic systems, Agentic AI Security Guide is a good fit for the layered controls around inputs, tools, orchestration, and blast-radius reduction. When the main concern is zero-click leakage from poisoned content, EchoLeak (Microsoft 365 Copilot) 2025 illustrates how untrusted content can cross from prompt manipulation into sensitive data exposure. For code-executing assistants, Gemini CLI prompt injection flaw 2025 shows why execution paths need stronger gating than chat paths.
How to keep injected text from becoming an action
Filtering adversarial text is useful, but it should be treated as a reducing control rather than a guarantee. Sanitisation, instruction stripping, content classification, and prompt firewalling can lower the chance that a malicious payload reaches the model in executable form, yet the safer design is to assume some malicious text will still get through.
That is why the more reliable control is to break the causal chain between model output and sensitive action. Use structured tool schemas, strict argument validation, and scoped permissions so the model cannot improvise commands or data queries outside approved parameters. Where the assistant proposes an action that affects code, records, or infrastructure, require an external policy engine or human confirmation for the dangerous step.
This becomes even more important when the assistant can call MCP tools, access files, or write back into business systems. The model should be able to recommend, not silently execute, anything that changes trust, privilege, or state. If the surrounding platform cannot distinguish a benign suggestion from an operational instruction, it is not ready for high-impact use.
Risk and Threat Considerations
Prompt injection is risky because the attacker does not need to break the model itself, only the trust boundary around it. Once malicious text is accepted as instruction, the next failure is usually privilege amplification: the model uses a connected tool, session, or data path that the attacker could not access directly.
Failure mechanism: the injected content persuades the model to ignore policy, retrieve restricted information, invoke a tool, or chain into code execution through overbroad permissions, weak validation, or missing approval gates.
Impact: the result can be source-code tampering, secret exposure, unauthorized data disclosure, or downstream actions taken under a legitimate application or user context, which makes detection and rollback harder.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Prompt injection often succeeds by steering tools into unsafe actions. |
| ASI03 — Identity & Privilege Abuse | Injected prompts become severe when they can exploit the agent's authority. | |
| ASI06 — Memory & Context Poisoning | Prompt injection commonly poisons context that the model later trusts. | |
| Recommendation — Restrict tool invocation with policy checks, allowlists, and confirmation gates. Scope agent privileges tightly and separate model output from privileged actions. Isolate untrusted context and validate retrieved content before it reaches reasoning. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | Tool-driven prompt injection can expose functions the caller should not reach. |
| Recommendation — Enforce function-level authorization on every model-triggered action. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Limiting model and tool permissions reduces injection blast radius. |
| SI-10 — Information Input Validation | Untrusted retrieved text and prompts need validation before use. | |
| Recommendation — Minimize privileges for agents, tools, and service accounts used by the system. Validate and sanitize inbound text before it influences model behavior. | ||
Practitioner Guidance
What to prioritise: put the strongest controls around the highest-impact actions first, especially anything that can execute code, access customer data, send messages, or modify records. The first design question is not whether the model can be tricked, but whether a tricked model can do anything important.
What to verify: check that retrieved content is isolated from system instructions, that tool calls are policy-checked before execution, and that dangerous outputs require an explicit allow decision from a separate control plane. If an injected prompt can reach a privileged tool unchanged, the control boundary is too weak.
Decision rule: if the assistant can touch production data or operational systems, treat prompt injection as an access-control problem, not just a content-filtering problem. If it cannot be isolated, reduce its authority until the remaining failure mode is limited to low-impact misinformation.
Practitioner takeaway: the right objective is not to make prompt injection impossible, it is to make it non-catastrophic by constraining authority, isolating inputs, and requiring independent checks before any sensitive action.
Related resources from NHI Mgmt Group
- Should organisations rely on model safety features alone to stop prompt injection?
- Why are AI gateways not enough to stop prompt injection and data leakage?
- What breaks when organisations rely on traditional input validation alone to stop prompt injection?
- How should organisations manage vendor and partner access to prevent stale systems from becoming a data breach path?